SNOW-CSA Application Rules, ACL and Notifications Practice Question
Exhibit
ACL Rule: incident.*
Name: incident.read
Type: record
Operation: read
Condition: gs.hasRole('snc_internal') || gs.getUserID() == 'admin'
Script debug:
gs.hasRole('snc_internal') returns false
gs.getUserID() returns 'john.doe'
User 'john.doe' is a member of role 'itil' only.Refer to the exhibit. A user with username 'john.doe' tries to view an incident record. What is the outcome?
⚠ Common exam trap
It's easy for candidates to assume having the 'itil' role guarantees read access to all incidents, but ServiceNow ACLs can deny access even to users with the correct role if a condition evaluates to false.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user cannot view the incident because the ACL condition evaluates to false.
The ACL condition on the incident table evaluates to false for user 'john.doe'. In ServiceNow, an ACL (Access Control List) with a condition that returns false prevents the user from viewing the record, even if they have a role like 'itil'. The exhibit likely shows an ACL with a condition such as 'true == false' or a script that returns false, which overrides any role-based access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user can view the incident because no ACLs apply to incident table.
Why it's wrong here
The ACL exists.
- ✗
The user can view the incident because they have the itil role.
Why it's wrong here
The ACL does not check itil role.
- ✗
The user cannot view the incident because the ACL is missing a condition for itil role.
Why it's wrong here
ACLs are configured per requirement; missing a role does not cause denial by default.
- ✓
The user cannot view the incident because the ACL condition evaluates to false.
Why this is correct
Both conditions are false, so read is denied.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 504 original SNOW-CSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SNOW-CSA practice question is part of Courseiva's free ServiceNow certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SNOW-CSA exam.